Brute Force Bug Disabling Primary User Account

ℹ️ Support
,
1
Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 24.0.0.1
Operating system and version (eg, Ubuntu 20.04): Ubuntu 20.04
Apache or nginx version (eg, Apache 2.4.25): Apacher 2.4
PHP version (eg, 7.4): php7.4-fpm

The issue you are facing:

I disabled brute force months ago in favor of fail2ban. Now, my webdav logins are being recorded as webdav login failures and causing -disabled- bruteforce to block my primary user account. I literally deleted all of my sync device logins and used the QR code to avoid any password mistakes. I have to manually enter phpmyadmin and clear my local ip from oc_bruteforce_attempts in the db in order to regain access. using the occ to reset brute has no effect.

Is this the first time you’ve seen this error? (Y/N):
Yes

Steps to replicate it:

  1. Overview = All checks passed
  2. Clean Apache2 error log (only modsec errors blocking internet bots, no errors related to my IP)
  3. Use QR code to connect sync device / apps (mobile phone)
  4. download later ubuntu 20.04 appimage desktop sync client.

The output of your Nextcloud log in Admin > Logging:

[PHP] Error: Error: count(): Parameter must be an array or an object that implements Countable at /home/adminuser/public_html/lib/private/Memcache/Redis.php#81 at <<closure>>

 0. <<closure>>
    OC\Log\ErrorHandler::onError()
 1. /home/adminuser/public_html/lib/private/Memcache/Redis.php line 81
    count()
 2. /home/adminuser/public_html/lib/private/Template/SCSSCacher.php line 380
    OC\Memcache\Redis->clear()
 3. /home/adminuser/public_html/lib/private/Template/SCSSCacher.php line 278
    OC\Template\SCSSCacher->resetCache()
 4. /home/adminuser/public_html/lib/private/Template/SCSSCacher.php line 142
    OC\Template\SCSSCacher->variablesChanged()
 5. /home/adminuser/public_html/lib/private/Template/CSSResourceLocator.php line 109
    OC\Template\SCSSCacher->process()
 6. /home/adminuser/public_html/lib/private/Template/CSSResourceLocator.php line 61
    OC\Template\CSSResourceLocator->cacheAndAppendScssIfExist()
 7. /home/adminuser/public_html/lib/private/Template/ResourceLocator.php line 78
    OC\Template\CSSResourceLocator->doFind()
 8. /home/adminuser/public_html/lib/private/TemplateLayout.php line 342
    OC\Template\ResourceLocator->find()
 9. /home/adminuser/public_html/lib/private/TemplateLayout.php line 250
    OC\TemplateLayout::findStylesheetFiles()
10. /home/adminuser/public_html/lib/private/legacy/OC_Template.php line 185
    OC\TemplateLayout->__construct()
11. /home/adminuser/public_html/lib/private/Template/Base.php line 132
    OC_Template->fetchPage()
12. /home/adminuser/public_html/lib/base.php line 802
    OC\Template\Base->printPage()
13. /home/adminuser/public_html/lib/base.php line 1104
    OC::init()
14. /home/adminuser/public_html/index.php line 34
    require_once("/home/adminuser/public_html/lib/base.php")

GET /.env
from 85.215.98.120 at 2022-05-28T04:51:47+00:00



[webdav] Fatal: Sabre\DAV\Exception\ServiceUnavailable: OC\User\LoginException: User disabled at <<closure>>

0. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php line 180
   OCA\DAV\Connector\Sabre\Auth->check()
1. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php line 135
   Sabre\DAV\Auth\Plugin->check()
2. /home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php line 89
   Sabre\DAV\Auth\Plugin->beforeMethod()
3. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 456
   Sabre\DAV\Server->emit()
4. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 253
   Sabre\DAV\Server->invokeMethod()
5. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 321
   Sabre\DAV\Server->start()
6. /home/adminuser/public_html/apps/dav/lib/Server.php line 352
   Sabre\DAV\Server->exec()
7. /home/adminuser/public_html/apps/dav/appinfo/v2/remote.php line 35
   OCA\DAV\Server->exec()
8. /home/adminuser/public_html/remote.php line 166
   require_once("/home/adminuser/ ... p")

PROPFIND /remote.php/dav/files/affecteduseraccount/
from 114.198.189.245 by affecteduseraccount at 2022-05-28T04:06:22+00:00


[no app in context] Error: OC\User\LoginException: User disabled at <<closure>>

 0. /home/adminuser/public_html/lib/private/User/Session.php line 654
    OC\User\Session->completeLogin("*** sensitive parameters replaced ***")
 1. /home/adminuser/public_html/lib/private/User/Session.php line 353
    OC\User\Session->loginWithToken("*** sensitive parameters replaced ***")
 2. /home/adminuser/public_html/lib/private/User/Session.php line 450
    OC\User\Session->login("*** sensitive parameters replaced ***")
 3. /home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php line 129
    OC\User\Session->logClientIn("*** sensitive parameters replaced ***")
 4. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php line 103
    OCA\DAV\Connector\Sabre\Auth->validateUserPass("*** sensitive parameters replaced ***")
 5. /home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php line 251
    Sabre\DAV\Auth\Backend\AbstractBasic->check()
 6. /home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php line 154
    OCA\DAV\Connector\Sabre\Auth->auth()
 7. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php line 180
    OCA\DAV\Connector\Sabre\Auth->check()
 8. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php line 135
    Sabre\DAV\Auth\Plugin->check()
 9. /home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php line 89
    Sabre\DAV\Auth\Plugin->beforeMethod()
10. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 456
    Sabre\DAV\Server->emit()
11. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 253
    Sabre\DAV\Server->invokeMethod()
12. /home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php line 321
    Sabre\DAV\Server->start()
13. /home/adminuser/public_html/apps/dav/lib/Server.php line 352
    Sabre\DAV\Server->exec()
14. /home/adminuser/public_html/apps/dav/appinfo/v2/remote.php line 35
    OCA\DAV\Server->exec()
15. /home/adminuser/public_html/remote.php line 166
    require_once("/home/adminuser/ ... p")

PROPFIND /remote.php/dav/files/affecteduseraccount/
from 114.198.189.245 by affecteduseraccount at 2022-05-28T04:06:22+00:00

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "www.example.com",
        "example.com"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "24.0.1.1",
    "overwrite.cli.url": "https:\/\/www.example.com",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "memcache.local": "\\OC\\Memcache\\Redis",
    "filelocking.enabled": true,
    "memcache.locking": "\\OC\\Memcache\\APCu",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": 6379,
        "timeout": 0,
        "password": "***REMOVED SENSITIVE VALUE***"
    },
    "default_phone_region": "CN",
    "log_type": "file",
    "logfile": "\/home\/adminuser\/ncerrors\/error.log",
    "loglevel": 2,
    "logdateformat": "F d, Y H:i:s",
    "log_rotate_size": "100 * 1024 * 1024",
    "trashbin_retention_obligation": "3, 7",
    "mail_smtpmode": "smtp",
    "mail_smtpsecure": "tls",
    "mail_sendmailmode": "smtp",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpauthtype": "PLAIN",
    "mail_smtpauth": 1,
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "587",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "maintenance": false,
    "auth.bruteforce.protection.enabled": "false",
    "theme": "",
    "app_install_overwrite": [
        "files_antivirus",
        "qownnotesapi",
        "appointments"
    ],
    "data-fingerprint": "9e02b4166b5ccd02c2e1fa2c15895a44"
}

The output of your Apache/nginx/system log in /var/log/____:

**NOTE:**: None of these errors belong to my IP address they are all internet bots
[Sat May 28 12:22:25.891514 2022] [:error] [pid 325776] [client 192.241.219.166:60982] [client 192.241.219.166] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/modsecurity-crs/coreruleset-3.3.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "119.12.161.48"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "119.12.161.48"] [uri "/actuator/health"] [unique_id "YpGjgSXhys11XZN9CH9PUQAAAAY"]
[Sat May 28 12:22:25.891351 2022] [:error] [pid 325776] [client 192.241.219.166:60982] [client 192.241.219.166] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/modsecurity-crs/coreruleset-3.3.2/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "54"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [hostname "119.12.161.48"] [uri "/actuator/health"] [unique_id "YpGjgSXhys11XZN9CH9PUQAAAAY"]
[Sat May 28 11:12:37.538897 2022] [:error] [pid 312284] [client 139.162.167.216:50272] [client 139.162.167.216] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/modsecurity-crs/coreruleset-3.3.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "119.12.161.48"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "119.12.161.48"] [uri "/"] [unique_id "YpGTJRbeyrQ8hG1i-iquvQAAAAQ"]

PASTE HERE


{"reqId":"YpGSTQuO3t8YjFnVw1eoQQAAAAU","level":2,"time":"May 28, 2022 03:09:27","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/ocs/v2.php/cloud/user?format=json","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.20.1","version":"24.0.1.1"}
{"reqId":"YpGST5UwBIKCgA@869rN8gAAAAE","level":2,"time":"May 28, 2022 03:09:29","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"PROPFIND","url":"/remote.php/dav/files/affecteduseraccount//","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.20.1","version":"24.0.1.1"}
{"reqId":"YpGS32EjRqurDafuuh4m@wAAAAY","level":2,"time":"May 28, 2022 03:11:28","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/index.php/apps/notes/api/v1/notes?pruneBefore=1653035478","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.20.1","version":"24.0.1.1"}
{"reqId":"YpGTJRbeyrQ8hG1i-iquvQAAAAQ","level":2,"time":"May 28, 2022 03:12:37","remoteAddr":"139.162.167.216","user":"--","app":"core","method":"GET","url":"/","message":"Trusted domain error. \"139.162.167.216\" tried to access using \"119.12.161.48\" as host.","userAgent":"Mozilla/5.0","version":"24.0.1.1"}
{"reqId":"YpGTQQ0S7RPQw0Krv@XcjAAAABU","level":2,"time":"May 28, 2022 03:13:06","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/ocs/v2.php/cloud/user?format=json","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.20.1","version":"24.0.1.1"}
{"reqId":"YpGTYbZyS--@Xs26ECF1@wAAAAI","level":2,"time":"May 28, 2022 03:13:38","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/ocs/v2.php/cloud/user?format=json","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.20.1","version":"24.0.1.1"}
{"reqId":"YpGUvAzzVJXrcPaLY4@lZAAAAA8","level":3,"time":"May 28, 2022 03:19:25","remoteAddr":"XXX.XXX.XXX.XXX","user":"affecteduseraccount","app":"notes","method":"GET","url":"/index.php/apps/notes/notes/9466","message":"Controller failed with OCA\\Notes\\Service\\NoteDoesNotExistException","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36","version":"24.0.1.1","exception":{"Exception":"OCA\\Notes\\Service\\NoteDoesNotExistException","Message":"","Code":0,"Trace":[{"file":"/home/adminuser/public_html/apps/notes/lib/Service/NotesService.php","line":54,"function":"getFileById","class":"OCA\\Notes\\Service\\NotesService","type":"::"},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/NotesController.php","line":136,"function":"get","class":"OCA\\Notes\\Service\\NotesService","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/Util.php","line":28,"function":"OCA\\Notes\\Controller\\{closure}","class":"OCA\\Notes\\Controller\\NotesController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/Helper.php","line":145,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/NotesController.php","line":150,"function":"handleErrorResponse","class":"OCA\\Notes\\Controller\\Helper","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/Http/Dispatcher.php","line":225,"function":"get","class":"OCA\\Notes\\Controller\\NotesController","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/Http/Dispatcher.php","line":133,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/App.php","line":172,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Route/Router.php","line":298,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/home/adminuser/public_html/lib/base.php","line":1023,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/home/adminuser/public_html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/home/adminuser/public_html/apps/notes/lib/Service/NotesService.php","Line":185,"CustomMessage":"Controller failed with OCA\\Notes\\Service\\NoteDoesNotExistException"}}
{"reqId":"YpGV7WkdW8TjczznjcvJDgAAAAc","level":2,"time":"May 28, 2022 03:24:30","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGWfmkdW8TjczznjcvJEgAAAAc","level":2,"time":"May 28, 2022 03:26:55","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGXoKYxI3bmN6YEXg97-QAAABY","level":2,"time":"May 28, 2022 03:31:45","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGXoY0hqPa4XPvf3HcqdAAAAAA","level":3,"time":"May 28, 2022 03:31:48","remoteAddr":"XXX.XXX.XXX.XXX","user":"affecteduseraccount","app":"PHP","method":"GET","url":"/index.php/apps/notes/notes?pruneBefore=1653708678","message":"file_get_contents(/home/adminuser/private/data/affecteduseraccount/files/Notes/New note.txt): failed to open stream: No such file or directory at /home/adminuser/public_html/lib/private/Files/Storage/Local.php#291","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36","version":"24.0.1.1","exception":{"Exception":"Error","Message":"file_get_contents(/home/adminuser/private/data/affecteduseraccount/files/Notes/New note.txt): failed to open stream: No such file or directory at /home/adminuser/public_html/lib/private/Files/Storage/Local.php#291","Code":0,"Trace":[{"function":"onError","class":"OC\\Log\\ErrorHandler","type":"::"},{"file":"/home/adminuser/public_html/lib/private/Files/Storage/Local.php","line":291,"function":"file_get_contents"},{"file":"/home/adminuser/public_html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":247,"function":"file_get_contents","class":"OC\\Files\\Storage\\Local","type":"->"},{"file":"/home/adminuser/public_html/apps/files_accesscontrol/lib/StorageWrapper.php","line":170,"function":"file_get_contents","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":247,"function":"file_get_contents","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->"},{"file":"/home/adminuser/public_html/apps/ransomware_protection/lib/StorageWrapper.php","line":240,"function":"file_get_contents","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Files/View.php","line":1177,"function":"file_get_contents","class":"OCA\\RansomwareProtection\\StorageWrapper","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Files/View.php","line":606,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Files/Node/File.php","line":56,"function":"file_get_contents","class":"OC\\Files\\View","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/Note.php","line":43,"function":"getContent","class":"OC\\Files\\Node\\File","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/MetaService.php","line":168,"function":"getContent","class":"OCA\\Notes\\Service\\Note","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/Util.php","line":28,"function":"OCA\\Notes\\Service\\{closure}","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/MetaService.php","line":169,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/MetaService.php","line":150,"function":"generateContentEtag","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/MetaService.php","line":124,"function":"updateIfNeeded","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/MetaService.php","line":82,"function":"createMeta","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/Helper.php","line":83,"function":"getAll","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/NotesController.php","line":69,"function":"getNotesAndCategories","class":"OCA\\Notes\\Controller\\Helper","type":"->"},{"file":"/home/adminuser/public_html/apps/notes/lib/Service/Util.php","line":28,"function":"OCA\\Notes\\Controller\\{closure}","class":"OCA\\Notes\\Controller\\NotesController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/Helper.php","line":145,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/home/adminuser/public_html/apps/notes/lib/Controller/NotesController.php","line":95,"function":"handleErrorResponse","class":"OCA\\Notes\\Controller\\Helper","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/Http/Dispatcher.php","line":225,"function":"index","class":"OCA\\Notes\\Controller\\NotesController","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/Http/Dispatcher.php","line":133,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/App.php","line":172,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Route/Router.php","line":298,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/home/adminuser/public_html/lib/base.php","line":1023,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/home/adminuser/public_html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/home/adminuser/public_html/lib/private/Log/ErrorHandler.php","Line":92,"CustomMessage":"--"}}
{"reqId":"YpGY7FzNODiKsu33i9QKtwAAAAg","level":2,"time":"May 28, 2022 03:37:17","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGZiKGVZd5goPtvPqyCcgAAAAw","level":2,"time":"May 28, 2022 03:39:53","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGbV1zNODiKsu33i9QKygAAAAg","level":2,"time":"May 28, 2022 03:47:35","remoteAddr":"205.210.31.133","user":"--","app":"core","method":"GET","url":"/","message":"Trusted domain error. \"205.210.31.133\" tried to access using \"ns2.pragmaticprodigy.com\" as host.","userAgent":"Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com","version":"24.0.1.1"}
{"reqId":"YpGbW7ZyS--@Xs26ECF2TwAAAAI","level":2,"time":"May 28, 2022 03:47:40","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGcnojVpfFowJpxcx0NygAAAAE","level":2,"time":"May 28, 2022 03:53:03","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGeqFzNODiKsu33i9QK3QAAAAg","level":2,"time":"May 28, 2022 04:01:45","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGfe2kdW8TjczznjcvJqgAAAAc","level":2,"time":"May 28, 2022 04:05:16","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGfkmkdW8TjczznjcvJrAAAAAc","level":2,"time":"May 28, 2022 04:05:39","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'affecteduseraccount' (Remote IP: 'XXX.XXX.XXX.XXX')","userAgent":"--","version":"24.0.1.1"}
{"reqId":"YpGfpUKhoc0P6R81hX-rxgAAAAE","level":3,"time":"May 28, 2022 04:05:57","remoteAddr":"XXX.XXX.XXX.XXX","user":"affecteduseraccount","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/affecteduseraccount/","message":"User disabled","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1","exception":{"Exception":"OC\\User\\LoginException","Message":"User disabled","Code":0,"Trace":[{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":654,"function":"completeLogin","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":353,"function":"loginWithToken","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":450,"function":"login","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":129,"function":"logClientIn","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php","line":103,"function":"validateUserPass","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":251,"function":"check","class":"Sabre\\DAV\\Auth\\Backend\\AbstractBasic","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":154,"function":"auth","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":180,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Server.php","line":352,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/remote.php","line":166,"args":["/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/adminuser/public_html/lib/private/User/Session.php","Line":370,"CustomMessage":"--"}}
{"reqId":"YpGfpUKhoc0P6R81hX-rxgAAAAE","level":4,"time":"May 28, 2022 04:05:57","remoteAddr":"XXX.XXX.XXX.XXX","user":"affecteduseraccount","app":"webdav","method":"PROPFIND","url":"/remote.php/dav/files/affecteduseraccount/","message":"OC\\User\\LoginException: User disabled","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"OC\\User\\LoginException: User disabled","Code":0,"Trace":[{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":180,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Server.php","line":352,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/remote.php","line":166,"args":["/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","Line":161,"CustomMessage":"--"}}
2

I just tried to enable the brute force app and manually add a whitelist for my IP address. Even with Brute force enabled… and the whitelist for my IP addr in place… my webdav login still fails and my primary user gets banned. :upside_down_face: frustrating.

3

Things that I have tried:

1.) I installed, verified whitelist of my IPs (problem persisted), then completely removed the brute force app, still problem persists as oc_bruteforce_attempts table is still in db
2.) I completely deactivated ModSec, for the specific virtualhost of my nextcloud instance
3.) I re-created the problem with ethernet cable and wifi connections
4.) I added my ip address as a trusted domain, problem persists
5.) I added my ip as a truested proxy, problem persists.
6.) I disconnected all sync clients, and only accessed via web nextcloud via Chromium browser, the problem persists.
7.) I accessed redis-cli and used “flushall” , problem persists

Anyone have a clue as to how to fix this? I don’t have a lot of sql experience and I don’t think it will solve the core problem, but… should drop the entire “oc_bruteforce_attempts” table from the database? getting desperate.

4

Though it was very disappointing not to get a response here or on github to a very serious problem (primary user being infinitely disabled by completely disabled app), I am now happy to say that after several months and updates, it seems that this problem has resolved itself and I have completely removed my previous workaround from cron.